John Shaw, Wisconsin DOT, 2013
Federal Highway Administration, 2013
Non-Significant Address Part (NAP)Upper Address Part (UAP)Lower Address Part (LAP) 00:00094E:22:19 Manufacturer-assigned, irrelevantCan be derived from trafficSent in every packet
University of Washington STAR Lab
Washington State Transportation Center, 2011
University of Washington STAR Lab
Remember this slide? LAP does not permit manufacturer identification; UAP/NAP is captured Not globally unique? 1 in 16,777,216 is pretty unique in most metro areas. Have two or more devices in your car?
Edward Snowden by way of the Washington Post
Areas on Seattle area highways showing recurrent inquiry activity Transmissions from 9E:8B:33:16 Locations match expected spots for route choice tracking, also DoT traffic cameras. Notably absent: SR520 bridge
Multiple areas where an address was found for <200M on each pass Approximates the area covered by a Class 1 Bluetooth transceiver Locations were a subset of inquiry scan locations! Notably absent: SR520 bridge, home of known Bluetooth speed sensors
Sent pages for the seven addresses detected in passive scan at their locations. No response. Standard Bluetooth devices usually don’t even have a way to turn off page scan – it’s not a standard mode. Trivial from a Linux PC, though. Unfortunately, this means we have no new data about the sniffers’ manufacturer, device capabilities, etc.